Legal claims defining the scope of protection. Each claim is shown in both the original legal language and a plain English translation.
1. A method, comprising: receiving, by a mail server, an electronic mail associated with multiple user accounts; classifying, by the mail server, the electronic mail as not spam in response to a spam filter; sending, by the mail server, the electronic mail to addresses associated with the multiple user accounts in response to the classifying of the electronic mail as the not spam; receiving, by the mail server, reports associated with the multiple user accounts, the reports indicating the electronic mail is missed spam by the spam filter; determining, by the mail server, inboxes associated with the multiple user accounts to which the missed spam has not been delivered; moving, by the mail server, the missed spam from the inboxes to spam folders associated with the multiple user accounts in response to the reports from the multiple user accounts; and raising, by the mail server, reputations associated with the multiple user accounts in response to the missed spam.
A mail server classifies incoming email as "not spam" using a spam filter. The email is then sent to multiple user accounts. If users report the email as missed spam, the server identifies inboxes that received the spam, moves the email to the spam folders of those users, and increases the reputation score of those users, presumably for providing useful feedback. This system relies on user reports to correct the spam filter's misclassifications and improve future filtering.
2. The method of claim 1 , further comprising determining a bad reputation associated with a sender of the electronic mail.
Building upon the method where a mail server uses user reports to reclassify missed spam (as described in claim 1), this adds functionality to determine a negative reputation score for the sender of the misclassified email. This "bad reputation" can be used in subsequent spam filtering decisions to block or quarantine emails from that sender more aggressively.
3. The method of claim 1 , further comprising associating the electronic mail to the inboxes in response to the classifying of the not spam by the spam filter.
Expanding on the process where a mail server sends emails initially classified as "not spam" to user inboxes (as described in claim 1), this specifies that the email is actively associated with the inboxes because of the initial "not spam" classification by the spam filter. This association is probably required for the system to later identify and move the email to spam folders when user reports indicate misclassification.
4. The method of claim 1 , further comprising sending a message that provides information concerning the missed spam.
In addition to the core spam reclassification method (defined in claim 1), the mail server sends a message to the user, providing information about the email that was reclassified as spam. This notification could explain why the email was moved, provide options to override the classification, or offer general spam awareness tips.
5. The method of claim 1 , further comprising: inserting an originating internet protocol address, a recipient email address, and a message identification in a message header associated with the electronic mail; and storing the message header associated with the electronic mail into a message database.
Further detailing the method of spam reclassification (outlined in claim 1), this adds steps to embed metadata within the email's header. Specifically, the originating IP address, recipient email address, and a unique message ID are inserted. This header information is then stored in a message database, presumably to track the email's journey and aid in spam analysis and prevention.
6. The method of claim 1 , further comprising lowering a reputation associated with a sender associated with the electronic mail.
This invention relates to email security systems designed to detect and mitigate malicious or unwanted electronic mail. The problem addressed is the proliferation of spam, phishing, and other malicious emails that bypass traditional filtering methods, causing security risks and operational disruptions. The invention enhances email security by dynamically adjusting the reputation of email senders based on their behavior and the content of their messages. The system analyzes incoming emails to identify suspicious patterns, such as unusual sender addresses, malicious attachments, or deceptive content. When such patterns are detected, the system lowers the reputation score of the sender. A lower reputation score triggers additional security measures, such as quarantining the email, flagging it for manual review, or blocking future messages from that sender. The reputation adjustment is based on historical data, real-time threat intelligence, and machine learning models that continuously improve detection accuracy. By dynamically adjusting sender reputations, the system reduces the likelihood of malicious emails reaching recipients while minimizing false positives. This approach improves email security without relying solely on static blacklists or rule-based filters, which can be easily evaded by attackers. The invention is particularly useful for enterprises and organizations that handle large volumes of emails and require robust protection against evolving threats.
7. The method of claim 1 , further comprising: adding an internet protocol address associated with a sender of the missed spam to a blacklist; identifying all emails associated with the internet protocol address associated with the sender of the missed spam; checking a status of the emails to determine whether the emails have been read; and moving unread ones of the emails to the spam folders.
Enhancing the method of reclassifying spam based on user reports (as described in claim 1), this incorporates a blacklist. The IP address of the sender of the reported spam is added to the blacklist. The system then identifies other emails from that IP address, checks if those emails have been read, and moves any unread emails to the users' spam folders.
8. An apparatus, comprising: a processor; and a memory device, the memory device storing computer program instructions, the computer program instructions when executed cause the processor to perform operations, the operations comprising: sending an electronic mail sent from a mail server to a user computer associated with a user account, the electronic mail having an initial classification as not spam by the mail server executing a spam filter; receiving a report from the user computer, the report indicating the electronic mail is missed spam after the initial classification as the not spam by the mail server executing the spam filter; adding an entry to a missed spam database, the missed spam database logging the missed spam reported by user accounts, the entry electronically associating an originating address associated with the missed spam to a recipient address associated with the user account; reclassifying the electronic mail as spam in response to the report from the user computer; identifying other electronic emails stored by the mail server from the originating address; determining unread ones of the other electronic emails stored by the mail server that have not been read; moving the unread ones of the other electronic emails to spam folders stored by the mail server; and raising a reputation associated with the user computer in response to the report indicating the electronic mail is incorrectly classified the missed spam; wherein the unread ones of the other electronic emails from the originating address are filtered after the initial classification as the not spam by the mail server executing the spam filter.
An apparatus (system) receives email sent from a mail server and initially classified as "not spam". A user reports the email as spam. The system adds an entry to a spam database, linking the sender's address to the recipient. The email is reclassified as spam. The system then identifies other unread emails from the same sender and moves them to spam folders. The system also increases the reputation of the user who reported the spam, rewarding user feedback to improve the accuracy of spam filtering after the original filtering happened.
9. The apparatus of claim 8 , wherein the operations further comprise determining a bad reputation associated with a sender associated with the electronic mail.
Building on the apparatus described where a mail server uses user reports to reclassify missed spam (as described in claim 8), this adds functionality to determine a negative reputation score for the sender of the misclassified email. This "bad reputation" can be used in subsequent spam filtering decisions to block or quarantine emails from that sender more aggressively.
10. The apparatus of claim 8 , wherein the operations further comprise moving the missed spam to a spam folder.
Expanding on the apparatus described where a mail server uses user reports to reclassify missed spam (as described in claim 8), the reported missed spam is moved to a spam folder. This ensures that the user is no longer presented with the misclassified email in their inbox.
11. The apparatus of claim 10 , wherein the operations further comprise sending a message to the user computer, the message providing information concerning the reclassifying of the electronic mail as the spam.
In addition to the apparatus (described in claim 8) which reclassifies emails as spam, the system sends a message to the user, providing information about the email that was reclassified as spam. This notification could explain why the email was moved, provide options to override the classification, or offer general spam awareness tips.
12. The apparatus of claim 8 , wherein the operations further comprise: inserting the originating address, a recipient email address, and a message identification in a message header associated with the electronic mail; and storing the message header associated with the entry in the missed spam database.
Further detailing the apparatus (outlined in claim 8), this adds steps to embed metadata within the email's header. Specifically, the originating address, recipient email address, and a unique message ID are inserted. This header information is then stored in a missed spam database.
13. The apparatus of claim 8 , wherein the operations further comprise lowering a reputation associated with a sender associated with the electronic mail.
Complementing the apparatus (described in claim 8) of reclassifying emails and raising user reputations, this feature lowers the reputation of the sender of the misclassified email. This sender reputation can be used to influence future spam filtering decisions, potentially blocking or quarantining emails from senders with low reputations.
14. A computer storage device storing computer program instructions which, when executed by a processor, cause the processor to perform operations, the operations comprising: sending an electronic mail sent from a mail server to a user computer associated with a user account, the electronic mail having an initial classification as not spam by the mail server executing a spam filter; receiving a report from the user computer, the report indicating the electronic mail is missed spam after the electronic mail was classified as the not spam by the mail server executing the spam filter; adding an entry to a missed spam database, the missed spam database logging the missed spam reported by user accounts, the entry electronically associating an originating address associated with the missed spam to a recipient address associated with the user account; reclassifying the electronic mail as spam in response to the report from the user computer; identifying other electronic emails stored by the mail server from the originating address; determining unread ones of the other electronic emails stored by the mail server that have not been read; moving the unread ones of the other electronic emails to spam folders stored by the mail server; and raising a reputation associated with the user computer in response to the report indicating the electronic mail is incorrectly classified the missed spam; wherein the unread ones of the other electronic emails from the originating address are twice filtered by the mail server.
A computer storage device stores instructions to implement a spam filtering system. The system receives emails from a server initially classified as "not spam." When a user reports an email as spam, an entry is added to a database linking the sender and recipient. The email is reclassified. Other unread emails from the same sender are moved to spam folders. The reporter's reputation increases. These unread emails are filtered twice - initially by the spam filter, and again after the user report.
15. The computer storage device of claim 14 , wherein the operations further comprise determining a bad reputation associated with a sender of the electronic mail.
Building on the computer storage device (described in claim 14) where a mail server uses user reports to reclassify missed spam, this adds functionality to determine a negative reputation score for the sender of the misclassified email. This "bad reputation" can be used in subsequent spam filtering decisions to block or quarantine emails from that sender more aggressively.
16. The computer storage device of claim 14 , wherein the operations further comprise moving the missed spam to a spam folder.
Expanding on the computer storage device (described in claim 14) where a mail server uses user reports to reclassify missed spam, the reported missed spam is moved to a spam folder. This ensures that the user is no longer presented with the misclassified email in their inbox.
17. The computer storage device of claim 16 , wherein the operations further comprise sending a message to the user computer providing information concerning the reclassifying of the electronic mail as the spam.
In addition to the computer storage device (described in claim 14) which reclassifies emails as spam, the system sends a message to the user, providing information about the email that was reclassified as spam. This notification could explain why the email was moved, provide options to override the classification, or offer general spam awareness tips.
18. The computer storage device of claim 14 , wherein the operations further comprise: inserting the originating address, a recipient email address, and a message identification in a message header associated with the electronic mail; and storing the message header associated with the entry in the missed spam database.
Further detailing the computer storage device (outlined in claim 14), this adds steps to embed metadata within the email's header. Specifically, the originating address, recipient email address, and a unique message ID are inserted. This header information is then stored in a missed spam database.
19. The computer storage device of claim 14 , wherein the operations further comprise lowering a reputation associated with a sender associated with the electronic mail.
Complementing the computer storage device (described in claim 14) of reclassifying emails and raising user reputations, this feature lowers the reputation of the sender of the misclassified email. This sender reputation can be used to influence future spam filtering decisions, potentially blocking or quarantining emails from senders with low reputations.
Unknown
October 24, 2017
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.